# Azure API Management domain verification

To verify a domain hosted on Azure API Management (APIM), typically on `azure-api.net`, for a pentest, complete the steps below.

APIM does not let you upload static files directly, so instead of hosting an `aikido.txt` file you configure an inbound policy that returns the verification token when Aikido requests `/aikido.txt`.

{% stepper %}
{% step %}
**Start the verification process**

Go to the final step of the pentest onboarding flow, where you can configure domain verification.
{% endstep %}

{% step %}
**Click verify**

Find your Azure APIM domain and click Verify. This starts the file upload verification flow.
{% endstep %}

{% step %}
**Copy the verification code**

Copy the verification code shown in Aikido. You will paste this code into the APIM policy in the next step.
{% endstep %}

{% step %}
**Add an inbound policy to your API**

In the Azure portal, open your API Management instance, go to **APIs**, select the API that serves the domain you want to verify, and open the **Design** tab. In the **Inbound processing** section, click the code editor (`</>`) and replace the policy with the snippet below.

Replace `AIKIDO_DOMAIN_VALIDATION_TOKEN_HERE` with the verification code you copied from Aikido.

```xml
<policies>
  <inbound>
    <base />
    <choose>
      <when condition="@(context.Request.OriginalUrl.Path == "/aikido.txt")">
        <return-response>
          <set-status code="200" reason="OK" />
          <set-header name="Content-Type" exists-action="override">
            <value>text/plain</value>
          </set-header>
          <set-body>AIKIDO_DOMAIN_VALIDATION_TOKEN_HERE</set-body>
        </return-response>
      </when>
    </choose>
  </inbound>
  <backend>
    <base />
  </backend>
  <outbound>
    <base />
  </outbound>
</policies>
```

Save the policy so it takes effect.
{% endstep %}

{% step %}
**Successful validation**

If the validation succeeds, you will see a confirmation toast in Aikido. You can then remove the `<when>` block from the policy if you no longer need it.
{% endstep %}
{% endstepper %}